Method and system for monitoring the quality of service in telecommunication networks, components and computer products thereof

ABSTRACT

To measure the quality of service at the application level in a telecommunication network (N), a function (A) is provided for carrying out sessions at the application level on said network (N). Through this activation function (A), sessions are then carried out, measuring (F) and also storing (H K  in a set of points (S 1 , . . . , S k , S n ) of the network (N) data indicative of the behavior of said network. The possible occurrence of critical situations relating to quality of service is verified (B) and, upon the occurrence of a said critical situation, a trigger signal (Trigger) is generated. By effect of the generation of said trigger signal, the data indicative of the behavior of the network measured and stored in the aforesaid set of points of the network (N) are collected in centralised fashion (H). The data thus collected are indicative of the end-to-end quality of service of the network (N) itself. Preferential application to packet networks like mobile telephony network such as GPRS or UMTS networks.

The present invention relates to the monitoring of the quality ofservice (or QoS, according to a commonly used acronym) intelecommunication networks.

The invention was developed with particular attention to its possibleapplication to packet telecommunication systems, such as mobiletelecommunication systems like GPRS (acronym for General Packet RadioService) or UMTS (acronym for Universal Mobile TelecommunicationsSystem).

In each case, the reference to said sectors of possible applicationshould not be construed as limiting the scope of the invention, which isaltogether general.

For monitoring telecommunication networks, there are various knownsystems, able to operate as distributed protocol analysers, thus able tocorrelate signalling messages and data in various points of the network.

For example, U.S. Pat. No. 5,850,386 discloses a protocol analyserusable to monitor the operation of digital transmission networks. Theanalyser in question is able to display statistics at the station level,network statistics, real time information on events occurring on thenetwork as well as information on the distribution of the protocols.Additionally, according to the known solution it is possible to generatebasic information on the operation of the network presenting theinformation simultaneously with real time performance information andmonitoring sessions of pre-programming activities. All this while alsogenerating reports linked to the analysis of the transmission network.

Systems of this kind, however, are conceived to operate in extendedfashion on the network and therefore are not suitable for occasional useor for being transported.

Moreover, said systems necessarily require the availability of aconsiderable storage capacity to allow the exhaustive collection ofinformation on appropriate databases.

Also available are protocol analysers able to carry out a thoroughpunctual analysis of the data that transit on one or more networkinterfaces.

Substantially deriving from this concept is the solution described inU.S. Pat. No. 6,397,359. In this solution, the performance of a networkare assessed defining test schedule comprising test protocols destinedto be implemented as well as indications about which protocols are to beexecuted for a plurality of connections on the network. A connection canbe defined between two end nodes of the network and, at specified timeinstants, the pair of end nodes in question executes the test protocol,measuring the performance of the network connection between the twonodes without thereby entailing any involvement of the applicationsoftware which can therefore be either installed or not installed on thehardware of the computers that support the end nodes.

In essence, systems of this kind—or substantially equivalent systems—arenot suited to correlate the data to be analysed with alarms generated inother points of the system or, better, of the network. Additionally,said systems essentially operate by measuring the performance of thenetwork connection: therefore, they are not able to analyse performancelinked to the perceived quality of a specific application session.

In truth, solutions able to monitor quality at the application level doexist. In this regard, reference can be made to the document U.S. Pat.No. 6,108,700, which discloses a solution that allows to measure theresponse time of an application (including distributed applications in aclient/server environment or on the Internet) as perceived by a finaluser.

Irrespective of all other considerations, systems of this nature,conceived mainly for use on computer networks, are usually not able—whenanomalous performance levels are detected—to investigate the causes ofmalfunction of the network in association with which they operate.

Substantially similar operating criteria, hence exposed to the samelimitations outlined above, also drove the design of the product madeavailable with the trade name of ResponseCenter 3.0 by the companyResponse Networks, Inc. of Alexandria, Va. (United States of America).

It is therefore still necessary to provide a solution that issimultaneously able to:

-   -   monitor Quality of Service (QoS) at the application level, and    -   identify the data needed to locate the problem in the network.

All this with specific attention to its possible use in applicationcontexts such as packet telecommunication networks like GPRS or UMTSmobile networks whereto reference was made above.

The aim of the present invention is to provide a solution that is ableto meet this requirement.

According to the present invention, said aim is achieved with a methodhaving the characteristic specifically set out in the claims thatfollow. The invention also relates, in distinct fashion, to thecorresponding system, as well as the related component apparatuses andcomputer products.

The term computer product (or computer program product) hereby indicatesa product that can be loaded directly into the internal memory of adigital computer and comprising portions of software code able, whenthis product is run on a computer, to implement the steps of the methodaccording to the invention and/or to perform the function of one or moreof the apparatuses composing the related system.

The solution according to the invention allows to detect eventsconsidered critical and to store in detailed fashion the correspondingdata flow in the network on the various interfaces consideredsignificant. The data collected can then be post-processed to identifyand possibly solve any critical conditions.

The invention shall now be described, purely by way of non limitingexample, with reference to the accompanying drawings, in which:

FIG. 1 shows in general terms the architecture of a system able tooperate according to the invention,

FIGS. 2, 3 and 4 are flow charts showing the possible operation of asystem capable of embodying the invention,

FIG. 5 shows, in the form of a block diagram, an example of testconfiguration that can be implemented using the invention,

FIG. 6 shows the architecture of a system like the one shown in FIG. 1,

FIGS. 7, 8 and 9 are flow charts illustrating the operation of thecomponent of FIG. 6,

FIG. 10 schematically shows further characteristics of the component ofFIG. 6, and

FIG. 11 proposes the diagram of a possible monitoring architectureaccording to the invention referred to a specific example ofapplication.

In FIGS. 1, the reference letter N indicates, in general, atelecommunication network within which a monitoring of the Quality ofService (QoS) and in particular a monitoring of the end-to-end Qualityof Service is to be conducted.

By way of indication, without thereby limiting the scope of theinvention, the network N can be constituted by a packettelecommunication network such as a GPRS or UMTS mobile network.

The numeric references S₁, S₂ (and, in general, S₁, S₂, . . . , S_(k), .. . , S_(n)) indicate apparatuses for monitoring the network interfacesto be analysed.

In this regard it will be appreciated that the solution according to theinvention is suitable to use a set of such apparatuses (hereinaftergenerally indicated as S_(k)) comprising any number of apparatuses.

These are apparatuses able to be placed practically in any point of thenetwork N to be analysed. This means that the apparatuses S_(k) canoperate on any network interface deemed to be of interest according tothe specific situations, and can thus be connected, in the case of amobile telecommunication network, both in correspondence with fixedinterfaces and in correspondence with mobile interfaces associated withthe mobile terminals of the network.

The apparatuses S_(k) are connected to a bi-directional communicationstructure, for instance of the bus type, indicated overall as P.

To the structure P is connected a central co-ordination apparatus Mwhereto is associated a structure for storing the collected data,indicated as H, destined to serve as an archive.

The references A and B respectively indicate an apparatus for conductingtest sessions at the application level and a testing apparatus formeasuring quality of service at the application level and signalling anycritical situations.

Lastly, Sync indicates the elements of a system for synchronising thevarious apparatuses mentioned above.

Additional indications about specific hardware embodiments of thevarious apparatuses or modules described above shall be provided in theremainder of this description.

At the general description level, the apparatus A is preferablyconfigured in such a way as to be able repeatedly to execute testsessions at the application level using the resources offered by thenetwork. This can make it necessary to access determined servers insideor outside the network (not shown in the figure), able to provide therequested service.

For each test, the apparatus A sends to the apparatus B information thatallow it to evaluate the measured quality of service, as well asinformation on times and, if necessary, the same data sent or receivedby the network.

Based on the information received by the apparatus A, the apparatus Btreats the data received in order to verify its consistency orinconsistency with determined quality of service (QoS) criteria.

In the most current applications, the data in question are compared withreference thresholds available within the apparatus B, which is able togenerate an alarm if the data received are found to be inconsistent withthe aforesaid thresholds.

The alarm is notified to the apparatus M and the data collected by theapparatus A are also sent, when necessary, to the archive H.

The communications in question are preferably exchanged through the samestructure P. However, a direct connection between the apparatus B andthe apparatus M can be provided—in the direction shown—to allow alarmmessages to be forwarded.

The apparatuses S_(k) are destined to co-operate with the interfaceswhereon it is considered useful to perform the monitoring action. Two ofsaid interfaces, indicated as I₁ and I₂, are represented in FIG. 1;hereinafter, the generic monitored interface shall be indicated asI_(k). Typically, it can be any data or signalling interface involved inthe application level operations relating to the tests conducted by theapparatus A.

In the case of a network N constituted by a packet network, the packetsthat transit on said interfaces I_(k) can be collected (possiblyfiltering—according to criteria better described hereafter—only thetraffic of interest for the test) by the monitoring apparatuses S_(k).The packets thus collected are stored by each apparatus on a memory suchas a circular buffer of appropriate size (not specifically shown in thedrawings, but of a known type) able to retain information for asufficiently long period of time. The dimensioning criteria of such amemory are described in greater detail hereafter.

Each monitoring apparatus S_(k) can also receive a trigger signal fromthe apparatus M. At the occurrence of such an event, each monitoringapparatus S_(k) is capable of sending to the archive H the datacontained in its circular buffer, continuing the monitoring action.

In a preferred embodiment of the invention, additional commands are alsoprovided, able to be sent by the apparatus M, for instance to start orstop the monitoring activity or, in general, to perform administrativeoperations on the apparatus.

The apparatus H serving as an archive has the purpose of centrallycollecting all data correlated to events detected as anomalies. Inparticular, for each anomaly, in the archive H there are collected datacoming:

-   from the apparatus A to conduct the tests at the application level,-   from the apparatus B to measure the quality of service and-   from the other monitoring apparatuses S_(k) associated to the    interfaces I_(k) to be analysed.

The central co-ordination apparatus, indicated as M in FIG. 1, has thepurpose of controlling in centralised fashion all other apparatusesincluded in the illustrated architecture. The functionality of theapparatus M provides that, upon receiving an alarm trigger signal fromthe apparatus B, the apparatus M sends corresponding trigger signals toall interface monitoring apparatuses.

In the currently preferred embodiment of the invention, the apparatus Mis also configured in such a way as to perform additional functions, forinstance to allow remotely controlling all apparatuses, activating them,deactivating them or configuring them as needed.

An important role within the architecture illustrated in FIG. 1 isperformed by the synchronisation system comprising the apparatusesindicated as Sync. Said apparatuses can be present in any number, alsoas a function of the general lay out (centralised or decentralisedarchitecture) selected for the synchronisation system. Usually, to allowfor an easy use of the system, the individual elements of thesynchronisation system can also be located at a certain mutual distance,possibly even in geographic locations that are quite distant from oneanother.

The presence of the synchronisation system in question is linked to theobservation of the fact that in order to assess performance it isimportant to take into account the time required to traverse the networkby the packets/signals. This presumes the fact that the variousapparatuses between which the aforesaid traversing times are measuredare in fact mutually synchronised. The accuracy of the system isdetermined in such a way as to be compatible with the precision of theinformation to be obtained.

The diagram of FIG. 2, substantially constituting a flow chart, showsthe basic operation of the central co-ordination apparatus M.

In essence, the apparatus M operates by cyclically performing, with aspeed that is correlated to the speed with which the phenomena to bemonitored evolve, a cyclic routine comprising a first step 100 ofwaiting for any modifications coming from the apparatus B followed—inthe presence of such a notification received from the apparatus B—by astep 102 in which a corresponding notification or trigger is sent to thevarious apparatuses for monitoring the interfaces S₁, . . . , S_(k), . .. , S_(n).

The flow chart of FIG. 3 shows, in a manner fundamentally similar to theone adopted in FIG. 2, the operation of the apparatus or apparatuses forconducting tests and measuring quality (reference A and B in the samefigure).

FIG. 4 instead shows the operation of any of the apparatuses S_(k)provided for monitoring the interfaces I_(k).

The figures in question naturally are purely illustrative in nature andare reproduced in simplified fashion to facilitate comprehension: itwill be appreciated that neither FIG. 2 nor FIGS. 3 and 4 show thenormal management functionalities such as starting processes,initialising and terminating processes, etc.

Focusing first on the apparatus for conducting the tests (reference A inFIG. 1), the step 200 in FIG. 3 indicates a normal starting stepfollowed by a step 202 in which the apparatus A identifies (according toprogramming/scheduling criteria set therein—according to criteria thatare known in themselves) the test destined to be conducted on eachoccasion.

This test is then performed in a step indicated as 204; in a step 206the apparatus A sends to the apparatus B, preferably on a dedicatedconnection, the data and parameters relating to the test performed.

Once this transmission is complete, the operation of the apparatus Aevolves again upstream of the step indicated as 202 to proceed with asuccessive test.

It is evident that this test can consist both of a “new” test relativeto the one performed previously, and of an “old” test already performedpreviously and repeated after a certain time interval.

The step indicated as 208 in FIG. 3 corresponds, with reference to theapparatus B, to a generic waiting step in which the apparatus B waits toreceive data and parameters relating to the tests conducted (accordingto the procedures described above) from the apparatus or apparatuses Aincluded in the system.

After receiving said data and parameters, in a step indicated as 210 theapparatus B verifies whether the information is consistent orinconsistent with determined quality criteria represented bycorresponding data stored in the apparatus B.

In the most current application example, said criteria are simplyrepresented by predefined threshold levels which the data and thequality parameters received from the module B are compared.

All this to proceed then, in a subsequent step 212, with a selection ordecision operation aimed at determining whether the aforesaid data orparameter are consistent or inconsistent with respect to the predefinedacceptability criteria stored in the apparatus B.

If the aforesaid data and parameters are not outside the prescribedlimits (negative outcome of the step 212, indicative of the fact thatthe test whereto the data and parameters in question refer detected noanomalous situation) the operation of the apparatus B again evolvestowards the waiting step indicated as 208.

Otherwise (positive outcome of the comparison carried out in the step212, indicative of the fact that the data and parameters from the testconducted did detect the presence of an anomalous situation), theapparatus B proceeds with a step 214 to send a correspondingnotification or trigger message to the apparatus M. The apparatus B, ina step 216, also sends to the archive H the collected data andparameters, which are indicative of (and identify) the anomaloussituation detected thanks to the test performed by the apparatus A.

The flow chart of FIG. 4, pertaining to the operation of a genericapparatus S_(k) for monitoring the interfaces I_(k), also starts from aninitial step 300 to evolve in preferred fashion in two directionsaccording to a typical concurrent process model.

The first direction of evolution is towards a step 302 in which theapparatus S_(k) awaits a packet of data/parameters from the respectiveinterface I_(k) being examined.

The reference 304 indicates a step in which the apparatus performs afiltering function according to the procedures better describedhereafter. Said filtering step or operation—which in itself incorporatessuccessive processing operations—can evolve both with a return upstreamof the step 302 (when the filtering operation fails to give rise to anyappreciable result) and towards a step 306 in which the data derivingfrom the filtering operation are added to the circular buffer associatedto the apparatus S_(k). All this to then recycle upstream of the step302.

The other process performed within the apparatus S_(k) instead comprisesa first step 307 of generic waiting for a message or triggergenerated—according to procedures better described hereafter—by theapparatus M. All this to proceed, in a subsequent step indicated as 308,performed upon receiving the aforesaid trigger signal, which comprisessending the data contained in the circular buffer of the apparatus S_(k)to the archive H.

The apparatus for performing the test indicated as A then operates bycontinuously performing a test at the application level and sending tothe apparatus for measuring the quality of service, indicated as B, themeasured performance data. Simultaneously, the monitoring apparatusesS_(k) intercept the packets considered to be of interest on the checkedinterfaces I_(k), storing them in their own circular buffers.

If the apparatus for measuring the quality of service B signals analarm, the central co-ordination apparatus M sends a trigger signal tothe monitoring apparatuses S_(k), which send to the archive H a copy oftheir circular buffer, continuing the monitoring operation.

In this way, in the presence of an alarm, the collected packets refer toa previous time window. Their analysis can therefore allow to obtaindetailed information, for instance to locate the so-called “bottlenecks”inside the network.

The circular buffers of the monitoring apparatuses S_(k) are dimensionedto assure that all information relating to a test session that may causean alarm are saved. For said dimensioning, one thus takes into accountthe type of session, the reasonably expected duration of the session(also in case of problems), the quantity of data that, downstream of thefilter, is collected on the buffer, and the delay times between theemergence of the critical situation and the arrival of the triggersignals to the monitoring apparatuses S_(k).

FIG. 5 shows an example of test configuration applied to a usagescenario in which the network N is constituted by a GPRS network.

In particular, it was assumed that the performance of the radiointerface and of the CGSN (Combined GPRS Support Node) are to be tested.The node in question incorporates the functionalities of the so-calledGGSN (Gateway GPRS Support Node) and of the so-called SGSN (Serving GPRSSupport Node).

The diagram of FIG. 5 highlights, in addition to the CGSN node, also aradio base station or BTS (Base Transceiver Station) and the BSC (BaseStation Control) module associated therewith.

Also highlighted is the connection between the CGSN node and acorresponding IP (Internet Protocol) network.

Moreover, the reference T1 indicates any mobile terminal included in thenetwork, presently connected to the BTS station shown herein.

Although the representation of FIG. 1 is limited to a single CGSN node,to a single BTS station, to a single BSC controller and to a singlemobile terminal T1, it will be appreciated that the field of applicationof the invention generally encompasses any number of said elements.

The diagram of FIG. 5 also shows the same references already introducedin relation to FIG. 1, which makes it superfluous to provide a newdescription of the role played by each of the elements indicated by saidreferences.

In regard to possible implementation details (described herein purely byway of example and hence with no intent to limit the scope of theinvention in any way at all) the mobile terminal T1 can be constitutedby any GPRS mobile terminal, preferably provided with the ability toanalyse the performance of the radio interface; it can be, for instance,a terminal of the type sold with the trade name of TEMS version 3.2 orhigher by the company Ericsson.

The apparatus A can be constructed by means of personal computers and inparticular by using the agent (or client—hereinafter the two names shallbe used equivalently) structure perfected by the Applicant andidentified with the name of BMPOP. Said agent solution, able to measurethe end-to-end quality of service (QoS) at the application level and tosend the collected data to a corresponding remote BMPOP server(apparatus B) can advantageously be implemented on a portable personalcomputer with the following characteristics:

-   -   Pentium IV, 500 MHz processor,    -   RAM 512 MB,    -   Windows NT/2000,    -   hard-disk 20 GB,    -   dual RS232 serial interface (able to achieve the connection to        the aforementioned terminal TEMS), and    -   GPS (Global Positioning System) function for synchronisation.

One or more of the trade names reproduced above and/or hereafter maycorrespond to de facto and/or registered trade marks.

The aforementioned BMPOP server, destined to serve the function of theapparatus B can be implemented on a PC (also of the fixed type,implementation on portable PC being instead preferred for the apparatusA) having the following characteristics:

-   -   Pentium IV, 500 MHz processor,    -   RAM 512 MB,    -   Windows NT/2000,    -   Oracle 8 database, and    -   hard-disk 34 GB.

This server is configured to operate as a centralised system to collectthe data provided by the client A.

In particular, as seen above, the server B is able to send alert ortrigger messages to the apparatus M that serves as master of the system,if anomalies are detected. The apparatus M operates as a generalisedsystem for managing and co-ordinating quality monitoring in co-operationwith the archive H.

The latter is constituted by a data base able to collect, through theapparatus M, the data provided by the various monitoring apparatusesS_(k) and by the server B.

From the viewpoint of practical realisation, the apparatus M and thearchive H associated thereto can be implemented on a same personalcomputer, for instance using a computer with the followingcharacteristics:

-   -   Pentium IV, 500 MHz processor,    -   RAM 512 MB,    -   Windows NT/2000, and    -   hard-disk 40 GB.

On this computer resides a simple application program (able to berealised according to criteria that are known, and hence such as not torequire a detailed description herein) able to receive—according to theprocedures described above—a trigger signal from the server B and tosend corresponding trigger messages to the various apparatuses S_(k)(whereof there are three, indicated respectively as S₁, S₂ and S₃ in theembodiment illustrated herein).

Said trigger signal can be obtained by sending a particular IP packet.

In the specific example of application—which, it is yet again specified,is in fact merely an example—whereto FIG. 5 refers, to each of theapparatuses S₁, S₂ and S₃ is associated a respective synchronisationmodule Sync—of a known type—preferably GPS based.

The apparatuses S₁, S₂ and S₃ can advantageously be realised using thesolution known with the trade name of SNIFFER (Network General Corp.).

In the example illustrated herein, the first apparatus S₁ is associatedto the mobile terminal T1 with the function of detecting the passage ofthe packets downstream of the application supported by the apparatus Aand of sending the related data to the archive H.

The apparatus S₂ is configured to store traffic on the interface Gibetween the node CGSN and the IP network and in this case as well tosend the related information on request to the archive H.

The apparatus S₃ is also a protocol analyser, able to analyse theinterface Gb between the node CGSN and the module BSC. It can be, forinstance, a TEKTRONIX K1297 analyser.

From the implementation point of view, the apparatus S₁ can beconfigured, for example, using a normal serial line SNIFFER solutioninstalled on the same personal computer that houses the client A (forexample EtherPeek version 3.6.2 by WildPacket's).

The apparatus S₂ can also be installed on a personal computer with thefollowing characteristics:

-   -   Pentium IV, 500 MHz processor,    -   RAM 512 MB,    -   Windows NT/2000, and    -   hard-disk 20 GB.

The apparatus S₂ preferably has the following characteristics:

-   -   it is able to store in a buffer, preferably of the circular        type, the IP packets that pass on the interface Gi,    -   it is able to interpret a trigger that activates an appropriate        predetermined operative process, and    -   it is able, given the aforesaid trigger, to send the collected        data to the archive H.

A possible implementation can be based on the primitives offered by thelibrary WinPcap version 2.3 or higher.

As stated previously, the apparatus S₂ is preferably connected to a GPSdevice to assure synchronisation with the other apparatuses.

The apparatus S₃ (able, as stated, to be implemented with TektronixK1297 instrumentation or equivalent instrumentation), preferably has thefollowing characteristics:

-   -   it is able to control the protocol stack of the GPRS on the        interface Gb;    -   it is able to store on a buffer, preferably of the circular        type, the packets that pass on the aforesaid interface,    -   it is able to receive and interpret a trigger that activates an        appropriate predefined operative process, and    -   it is able, given the aforesaid trigger, to send the collected        data to the archive H.

In this case too, synchronisation is preferably achieved by connectionto a GPS device.

Additional characteristics of realisation of the apparatuses S₁, S₂ andS₃ (or of equivalent apparatuses) shall be described hereafter.

Still with reference to the diagram of FIG. 5 it can be recalled that—inthe currently preferred embodiment—the mobile terminal T1 can also beconfigured to perform functionalities of monitoring the radio interface:the related software for managing and controlling said functionalitiesresides on the same personal computer that houses the agent indicated asA.

In essential terms, and referring to the same general operating criteriadescribed above, the operation of the solution illustrated in FIG. 5provides for the apparatus A serving as agent to perform continual testsof the end-to-end quality of service towards specific destinations (forinstance towards specific server addresses on the IP network).

The apparatus S₁ detects the passage of the packets and the timesthereof, sending the corresponding information to the archive H.

Simultaneously, the apparatuses S₂ and S₃ continuously monitorrespectively the interface Gi and the interface Gb, filtering thepackets exchanged between the agent A and the remote servers connectedthrough the IP network.

The data are collected in corresponding buffers. Preferably, these arecircular buffers in which the oldest data are overwritten. When theserver B detects a critical situation, it sends—through the apparatus Mserving as master—a warning message or trigger to the apparatuses S₁, S₂and S₃. These apparatuses copy the data collected up to that moment andsend it to the archive H.

The data thus collected (and any other data that may have been provideddirectly by the apparatus B—note the dashed line at the upper end ofFIG. 5) are thus made available for processing.

The processing operation typically has a post-processing character,since most of the time it is a function of analysis of the collecteddata, able to be performed both automatically and semi-automaticallywith the intervention of one or more operators. It will be appreciatedthat the criteria and the procedures for carrying out said processingoperation, indicated as PP in the diagram of FIG. 5, are outside thespecific scope of the present invention.

In a context like the GPRS context whereto FIG. 5 refers by way ofexample, it is possible to identify quality indicators such as:

-   -   down-link and up-link crossing times through a network segment        (access network, CGSN node, etc.);    -   TCP (Transmission Control Protocol) losses and re-transmissions        on the IP interfaces,    -   evaluation of the windows used by the TCP protocol, and    -   correlation between the RLC (Radio Link Control) and TCP        protocols.

The currently preferred embodiment in relation to the architecture ofthe apparatuses S_(k) will now be described with reference to thediagram of FIG. 6.

In this regard it will appreciated that such an architecture can be usedadvantageously both to realise all the apparatuses S_(k) and to realiseonly some of said apparatuses.

For instance, with reference to the architecture shown in FIG. 5, allthree the apparatuses S₁, S₂ and S₃ serve the function of monitoringtransiting packets, also exhibiting the characteristic of beingcontrollable remotely and of sending to an equally remote server thecollected information.

Solutions capable of detecting packets transiting on a packettelecommunication network, also operating appropriate filtering actions,are already available today (see in this regard the considerations madein the introductory part of the present description). Also known aremore complex hardware and software systems, able to monitor multiplenetwork interfaces, to recognise and interpret multiple standardprotocols. All this, if necessary, with the ability to interpret thepassage of determined packets or messages contained therein as alarm ortrigger messages, able to activate determined behaviours by the system.

A common characteristic of said known systems is that of providing forthe possibility of locally storing the measured data, in order toconstitute an archive that can be consulted a posteriori.

Within the context of the present invention, however, it is important tohave available apparatuses capable of being used remotely, i.e.apparatuses able locally to detect the packets, to filter and store theinformation and to send to a remote server the collected data, given theoccurrence of determined events.

The diagram of FIG. 6 represents the general architecture of any moduleS_(k) able to be included in a system of the type illustrated in FIGS. 1and 5.

To facilitate comprehension, the diagram of FIG. 6 shows only, inaddition to a single apparatus S_(k), the network N to be analysed andthe apparatus M acting as remote server destined to send to the variousapparatuses S_(k) (by effect of the reception of an alert or triggersignal by the apparatus B in FIGS. 1 and 5) corresponding triggersignals destined to cause the apparatus S_(k) involved on each occasionto send the data it has available to the apparatus M.

The general architecture of the apparatus or module S_(k) comprises, inthe currently preferred embodiment:

-   -   a packet filtering module, indicated as F,    -   a memory H_(k) for archiving the data at the S_(k) module level,    -   an apparatus M_(k) to perform—also at the local level—a        co-ordination function, and    -   a set of connection functionalities.

In the first place, a connection functionality K is provided, operatingbetween the network N and the apparatus S_(k) for the collection of themonitoring data relating to the interfaces I_(k).

In regard to the transmission of the monitoring data from theapparatuses S_(k) to the apparatus M and for the transmission of thetrigger signal from the apparatus M to the various apparatuses S_(k),different solutions can be employed.

For example, it is possible to provide a main connection function C forthe transmission of the monitoring data from the apparatuses S_(k) tothe apparatus M and an auxiliary function C_(t) for the transmission ofthe trigger signal from the apparatus M to the various apparatusesS_(k).

As a total or partial alternative, for the transmission of themonitoring data from the apparatuses S_(k) to the apparatus M and/or forthe transmission of the trigger signal from the apparatus M to thevarious apparatuses S_(k), it is possible to use the same network N tobe monitored.

In this case it is possible to provide a first connection functionality,indicated as C′, for the transmission of the monitoring data from theapparatuses S_(k) to the network N and a second connectionfunctionality, indicated as C″, operating between the network N and theapparatus M. This second connection functionality can be used both forthe transmission of the monitoring data from the network N to theapparatus M and for the transmission of the trigger signal from theapparatus M to the network N.

When this latter solution is adopted, in the individual module S_(k) isalso present a sub-module or device for intercepting the triggermessages, indicated as T. The device T analyses the packets transitingin the network and, if it detects packets that meet definablecriteria—according to known criteria—during the configuration of theapparatus S_(k), it interprets said packets as trigger signals, givingcommunication thereof to the respective module H_(k) so it will operateaccordingly.

The packet filtering system F performs a selection of the packetstransiting in the network (for instance on the interfaces Gi and Gb inthe case of the apparatuses S₂ and S₃ of FIG. 5). This occurs accordingto defined criteria—in a known manner—during the configuration of theindividual apparatus S_(k). Only the packets that meet the predefinedcriteria are considered and sent to the local archive H_(k).

The data archiving module H_(k) serves the function of archiving thepackets that come from the filtering module F. As stated, to implementthe module H_(k) a circular buffer archive is currently preferred, inwhich the oldest data are overwritten in order to limit to a maximumvalue (determined selectively as a function of the applicationrequirements) the quantity of data stored.

Said quantity is defined—also according to known criteria—whenconfiguring the apparatus S_(k) taking into account the desiredextension of the time “window” of observation associated with the datathat, stored at the level of the individual apparatus S_(k), are thentransmitted to the apparatus M in view of their storage in thecentralised archive H.

It is preferable for the filtering module F to be able to discard alltraffic generated by the apparatus S_(k) whereto it is associated,including the traffic generated to send the data to the apparatus M.

The flow charts of FIGS. 7, 8 and 9 show in greater detail the operatingcriteria of the filtering module F, of the co-ordination module M_(k)and of the module T (if present).

In this case as well, as in the case of FIGS. 2 through 4, for the sakeof illustration simplicity the additional management functionalities,which nonetheless are present, are not depicted: for example, processstarting, initialisation, termination etc.

The operation of the module F essentially comprises three successivesteps, repeated according to a cyclical order.

The first step, indicated as 400 in FIG. 7, consists of waiting for thepackets starting from the network N or, more precisely, from themonitored interface.

The packets received are then subjected, in a subsequent step indicatedas 402, to the actual filtering function.

If the packet considered on each occasion is not relevant for purposesof the monitoring function (negative outcome of the step 402) therelated packet is discarded and the system returns to the waiting step400.

If, on the contrary, the step 402 yields a positive outcome, indicatingthat the packet considered on each occasion is relevant for purposes ofthe monitoring function, in a subsequent step 404 said packet is sent tothe archive H_(k) and the system returns to the waiting step 400.

As has been indicated several times, the buffer H_(k) is preferablyorganised in the form of circular buffer, in which the oldest data areoverwritten by the most recent ones. Said buffer must be correctlydimensioned to assure the saving of all information of interest about aprocessing session. For said dimensioning, therefore, the type ofsession, its duration and the quantity of data collected on the bufferdownstream of the filtering function are taken into account.

The operation of the module M_(k) essentially comprises a waiting step500, in which the module M_(k) detects the possible arrival of thetrigger signal (received—with reference to the architecture representedin FIGS. 1 and 5—from the module M).

All this to proceed, upon receiving said signal, to send to theapparatus M the data contained in the archive H_(k). This sending stepis indicated as 502 in the diagram of FIG. 8.

The flow chart of FIG. 9 refers to the operation of the module T able toproceed with the detection of the trigger signal when said signal,instead of being received starting from the apparatus M, is generatedinside the apparatus S_(k) by means of an operation of observation ofthe packets transiting on the network N.

In FIG. 9, the related waiting step is indicated with the reference 602,whilst the reference 604 indicates a successive checking step in whichthe module T examines the packet received from the module T to establishwhether it meets the criteria to identify said packet as correspondingto a trigger signal.

If the outcome is negative, the operation of the module T simply evolvesbackwards upstream of the waiting step 602.

If the step 604 has a positive outcome, the module T signals to theapparatus M_(k) the detection of a trigger.

The preferential hardware and software configurations for implementingthe apparatuses S_(k) and M by means of personal computer have alreadybeen described above.

The diagram of FIG. 10 aims further to highlight the fact that theindividual apparatus S_(k) can advantageously be configured in such away as to have a connection K towards the network N to be analysed, as aset of connection functionalities towards the apparatus M able to beboth direct (functionality C, C_(t) of FIG. 6) and indirect(functionality C′ and C″ in the same FIG. 6).

As illustrated above, the connection functionalities between theapparatus S_(k) and the apparatus M can transit either on an appropriatenetwork (for instance a LAN or Local Area Network) or exploiting forconnection purposes the same network N to be analysed.

The personal computer used to implement the apparatuses S_(k) istherefore usually provided with the interfaces required for thedescribed connections, whilst the program, able to configure saidapparatus as an FTP (File Transfer Protocol) server, can advantageouslybe installed on the apparatus M. An advantageous solution in this regardis the solution available with the trade name of BulletProof FTP server2.15.

Advantageously, as a trigger signal it is possible to use an ICMP(Internet Control Message Protocol) packet with a predetermined payload.

The mechanism for capturing the packets, filtering and detecting thetrigger signal (if provided at the level of the apparatus S_(k)) caneasily be achieved with the primitives offered by the aforementionedWinPcap library. The captured packets can be saved on a circular bufferrealised by writing on three files in rotation, with the passage fromone file to the other occurring upon exceeding a given dimension (forinstance one MB for each file). When capturing the packets, a simpleverification of their content at the ICMP level (which bears directly onthe Internet Protocol IP) allows to detect the trigger. Upon detectingthe trigger, the three files whereon the data archiving is to becontinued are changed and the files previously used are sent to theremote FTP server by means of the FTP command. The sent files can thenbe deleted from the archive of the apparatus S_(k).

By way of additional example of possible use of the solution accordingto the invention, with reference to the diagram in FIG. 11 thedescription is provided of the implementation of a specific function formeasuring quality of service carried out in a GPRS environment of thetype already illustrated with reference to FIG. 5.

It is recalled once again that reference to such a possible applicationcontext must not be construed in any way as limiting the scope of theinvention.

In the specific case considered in FIG. 11, the situation is assumed tobe one in which the end-to-end quality of service is negativelyinfluenced by the fact that the software for managing the radioresources used in the GPRS network does not operate properly and, as aresult, it occasionally subtracts radio resources from a user, thenreallocates them with a consequent loss of throughput coinciding withthese events.

FIG. 11 represents an example of architecture that allows to identifythe aforesaid problem.

It will be appreciated that this figure shows several apparatus/modulesalready illustrated with reference to the diagrams of FIGS. 1 and 5. Forthis reason, the description of the nature and of the function of thesemodules is not repeated herein.

With respect to the elements already showed in FIGS. 1 and 5, FIG. 11illustrates the presence of an access point AP serving as WLAN (WirelessLocal Area Network) access point and the presence of a local FTP server,indicated as FTPL, connected to the interface Gi between the node CGSNand the network IP. The access point AP is connected through an Ethernetcable CE to the apparatus S₃ (implemented by means of Tektronix K1297instrumentation).

The same FIG. 11 also shows the WLAN connections existing between thenode AP and the apparatus M, the apparatus A and the apparatus S₃. Saidconnections (destined to assure the various functionalities oftransmission of the trigger over cable, of the trigger over WLAN, ofsynchronisation on WLAN, as well as data transmission over WLAN) operateaccording to known criteria, which do not require a detailed descriptionherein.

In this case the mobile terminal T1 connected to the apparatus A actingas client is a test terminal able to monitor the radio interface. It canbe, with reference to the examples provided above, a TEMS terminalproduced by Ericsson, equipped with the management software called TEMSInvestigation.

It will also be appreciated that the apparatus indicated as S₃ in thediagram of FIG. 11 in fact incorporates functionalities of monitoringboth interfaces Gi and Gb which, in the diagram of FIG. 5, are shownattributed to two different apparatuses indicated respectively as S₂ andS₃.

The diagram of FIG. 11 corresponds in this regard to an implementationsimplification linked to the fact that, in the context consideredherein, it is possible to aggregate both monitoring functions and have asingle instrumentation set perform them.

This fact also allows to perceive that the general architectures shownin FIGS. 1 and 5 can easily be subject, thanks to their veryflexibility, to implementation variations of this nature.

The choice—preferential but certainly not imperative—to use a local FTPserver, such as the server FTPL shown in FIG. 11, is mainly linked tothe desire not to introduce delays and losses typical of the Internetworld.

The tests are performed in a controlled radio environment. To this end,the GPRS channels are allocated statically and only one user is allowed.Said user is thus able to exploit all the radio resources the networkmakes available for a given cell served by a particular BTS.

The apparatus A performs continuous FTP download tests from the serverFTPL and computes throughput at the application level. Through the testterminal management function, it is possible to monitor all messages onthe radio interface and simultaneously, through the protocol analysisfunction implemented by the apparatus S₃, the packets transiting on thenetwork interfaces Gb and Gi are recorded to compute the throughputinside the network.

The data collected by the apparatus A indicate an occasional throughputdrop. On the other hand, the data collected on the interfaces Gb and Giindicate that there are no delays as would justify the anomaly, at thecore network level. Analysis of the data collected starting from themobile terminal T1 highlights the presence of messages indicating lossessubsequent to reallocation of radio resources by the network in asituation in which this should not occur (the test conditions provide,as stated, for the presence of only one user with static allocation ofthe resources). The performed analysis therefore allows to conclude withcertainty that the problem resides in the malfunction of the radioresource management function used by the system.

Naturally, without varying the principle of the invention, therealisation details and the embodiments may be widely varied from whatis described and illustrated herein, without thereby departing from thescope of the present invention.

1. Method for measuring quality of service at the application level in atelecommunication network (N), characterised in that it comprises thesteps of: providing an activation function (A) for carrying out sessionsat the application level on said network (N), carrying out a session bymeans of said function (A), by measuring (F) and storing (H_(k)), in aset of points (S₁, . . . , S_(k), . . . , S_(n)) of said network (N),data indicative of the behaviour of said network and verifying (B) anemergence of a critical situation in relation to said quality ofservice, generating a trigger signal (Trigger) when said criticalsituation emerges, and collecting (H), by effect of the generation ofsaid trigger signal, said data indicative of the behaviour of thenetwork measured and stored in said set of points of the network (N),the data thus collected being indicative of the quality of service ofthe network (N) itself.
 2. Method as claimed in claim 1, characterisedin that said step of measuring (F) and storing (H_(k)) said dataindicative of the behaviour of said network (N) is carried out in aplurality of different points (S₁, . . . , S_(k), . . . , S_(n)) of saidnetwork.
 3. Method as claimed in claim 2, characterised in that saidstep of measuring (F) said data indicative of the behaviour of saidnetwork is carried out in synchronised fashion (Sync) in said differentpoints (S₁, . . . , S_(k), . . . , S_(n)) of said network.
 4. Method asclaimed in claim 2 or claim 3, characterised in that it comprises thesteps of: storing (H_(k)) said data indicative of the behaviour of saidnetwork at the level of the corresponding point of said set, andcollecting said data indicative of the behaviour of said network (N) ata centralised level (H) by effect of the generation of said triggersignal.
 5. Method as claimed in any of the claims 2 a 4, characterisedin that it comprises the steps of: providing a centralised function (M)for managing the quality of service of the network, sending said triggersignal (Trigger) to said centralised function (M), and transmitting saidtrigger signal starting from said centralised function (M) to the pointsof said set (S₁, . . . , S_(k), . . . , S_(n)) in order to proceed withthe collection of said data indicative of the behaviour of said network.6. Method as claimed in any of the previous claims, characterised inthat it comprises the steps of: associating to said activation function(A) a control function (B) sensitive to data that may be indicative ofcritical situations relating to the quality of service of the network,and subjecting said data that may be indicative of critical situationsrelating to the quality of service of the network to filtering (212)through said control function (B), said control function (B) being ableto generate said trigger signal (214) by effect of said filteringfunction (212).
 7. Method as claimed in claim 6, characterised in thatsaid activation function (A) and said control function (B) co-operatewith each other according to a general agent/server configuration, inwhich said activation function (A) acts as an agent and said controlfunction (B) acts as a server.
 8. Method as claimed in any of theprevious claims, applied to the measurement of the quality of service ofa telecommunication network comprising a plurality of interfaces (Gi,Gb), characterised in that said step of measuring in a set of points(S₁, . . . , S_(k), . . . , S_(n)) of said network (N) data indicativeof the behaviour of the network (N) itself implies monitoring the datatransiting on one of said interfaces (Gi, Gb).
 9. Method as claimed inany of the previous claims, characterised in that the step of storing(H) data indicative of the behaviour of said network in a set of points(S₁, . . . , S_(k), . . . , S_(n)) of said network (N) entails storingdata relating to a given time window.
 10. Method as claimed in any ofthe previous claims, characterised in that it comprises the step ofproviding at least a respective transmission channel (C, C_(t)) toforward at least one signal between: said trigger signal to the pointsof said set (S₁, . . . , S_(k), . . . , S_(n)), and said data indicativeof the behaviour of the network(N) measured (F) and stored (H) in thepoints of said set.
 11. Method as claimed in any of the claims 1 to 10,characterised in that it comprises the step of transmitting on saidnetwork being monitored (N) at least a signal between: said triggersignal to the points of said set (S₁, . . . , S_(k), . . . , S_(n)), andsaid data indicative of the behaviour of the network(N) measured (F) andstored (H) in the points of said set.
 12. Method as claimed in claim 11,characterised in that it comprises the step of providing in the pointsof said set (S₁, . . . , S_(k), . . . , S_(n)) a filtering function (T)to intercept said trigger signal transmitted on said network (N) beingmonitored.
 13. System for measuring the quality of service at theapplication level in a telecommunication network (N), characterised inthat it comprises: at least one activating apparatus (A) for carryingout sessions at the application level on said network (N), at least onemonitoring apparatus (S₁, . . . , S_(k), . . . , S_(n)) to measure (F)and store (H_(k)) in a set of points (S₁, . . . , S_(k), . . . , S_(n))of said network (N) data indicative of the behaviour of said network, atleast one testing apparatus (B) to test for the occurrence of criticalsituations related to said quality of service and to generate, at theemergence of a said critical situation, a warning signal (Trigger), anda collecting apparatus (H) to collect, by effect of the generation ofsaid trigger signal, said data indicative of the behaviour of thenetwork measured and stored in said set of points of the network (N),the data thus collected being indicative of the quality of the network(N) itself.
 14. System as claimed in claim 13, characterised in that itcomprises a plurality of said monitoring apparatuses (S₁, . . . , S_(k),. . . , S_(n)) to measure (F) and store (H_(k)) in a plurality ofdifferent points (S₁, . . . , S_(k), . . . , S_(n)) of said network (N)said data indicative of the behaviour of the network (N).
 15. System asclaimed in claim 14, characterised in that it comprises synchronisationmodules (Sync) associated to said plurality of monitoring apparatuses(S₁, . . . , S_(k), . . . , S_(n)) to measure (F) said data indicativeof the behaviour of said network (N) in synchronised fashion on saiddifferent points (S₁, . . . , S_(k), . . . , S_(n)) of said network (N).16. System as claimed in claim 14 or claim 15, characterised in thatsaid plurality of monitoring apparatuses (S₁, . . . , S_(k), . . . ,S_(n)) comprises: a memory (H_(k)) for storing at the level of thecorresponding point of said set (S₁, . . . , S_(k), . . . , S_(n)) saiddata indicative of the behaviour of said network, and a transmissionmodule (M_(k)) to transmit said data indicative of the behaviour of saidnetwork (N) to said collecting apparatus (H) by effect of the generationof said trigger signal.
 17. System as claimed in any of the claims 13 a16, characterised in that it comprises an apparatus for the centralmanagement (M) of the quality of service of the network configured toreceived said trigger signal (Trigger) from said at least one testingapparatus (B) and to broadcast said trigger signal to said at least onemonitoring apparatus (S₁, . . . , S_(k), . . . , S_(n)).
 18. System asclaimed in any of the claims 13 a 17, characterised in that said atleast one activating apparatus (A) and said at least one testingapparatus (B) mutually co-operate according to a general agent/serverconfiguration, in which said activating apparatus (A) acts as agent andsaid verification apparatus (B) acts as server.
 19. System as claimed inany of the previous claims 13 through 18, for measuring the quality ofservice of a telecommunication network comprising a plurality ofinterfaces (Gi, Gb), characterised in that said at least one monitoringapparatus (S₁, . . . , S_(k), . . . , S_(n)) is an apparatus formonitoring the data transiting on one of said interfaces (Gi, Gb). 20.System as claimed in any of the previous claims 13 through 19,characterised in that said at least one monitoring apparatus (S₁, . . ., S_(k), . . . , S_(n)) comprises a memory (H_(k)) dimensioned to storedata indicative of the behaviour of said network (N) relating to a giventime window.
 21. System as claimed in any of the previous claims 13through 20, characterised in that it comprises at least one respectivetransmission channel (C, C_(t)) to forward at least one signal between:said trigger signal to said at least one monitoring apparatus (S₁, . . ., S_(k), S_(n)), and said data indicative of the behaviour of thenetwork (N) measured (F) and stored (H) starting from said at least onemonitoring apparatus (S₁, . . . , S_(k), . . . , S_(n)).
 22. System asclaimed in any of the claims 13 to 21, characterised in that it isconfigured to transmit on said network (N) being monitored at least onesignal between: said trigger signal to at least one monitoring apparatus(S₁, . . . , S_(k), . . . , S_(n)), and said data indicative of thebehaviour of the network (N) measured (F) and stored (H) starting fromsaid at least one monitoring apparatus (S₁, . . . , S_(k), . . . ,S_(n)).
 23. System as claimed in claim 22, characterised in that said atleast one monitoring apparatus (S₁, . . . , S_(k), . . . , S_(n))comprises an additional filtering module (T) to intercept said triggersignal transmitted on said network being monitored (N).
 24. Computerprogram product able to be directly loaded into the memory of a digitalcomputer and comprising portions of software code able to perform saidfunction of carrying out session at the application level on saidnetwork (N), within a method as claimed in any of the claims 1 through12, when said computer program product is run on a digital computer. 25.Computer program product able to be loaded directly into a digitalcomputer and comprising portions of software code able to carry out saidsteps of measuring (F) and storing (H) said data indicative of thebehaviour of the network (N), within a method as claimed in any of theclaims 1 through 12, when the computer program product is run on adigital computer.
 26. Computer program product able to be loadeddirectly into the memory of a digital computer and able to carry out oneamong the step of verifying (B) the possible occurrence of a criticalsituation relating to said quality of service and the step of generatinga trigger signal (Trigger) upon the occurrence of said criticalsituation, within a method as claimed in any of the claims 1 through 12,when said computer program product is run on a digital computer. 27.Computer program product able to be loaded directly into the memory of adigital computer and comprising portions of software code able to carryout at least one among the steps of: sending said trigger signal(Trigger) to the points of said set, and collecting, by effect of thegeneration of said trigger signal, said data indicative of the behaviourof said network measured and stored in said set of points, within amethod as claimed in any of the claims 1 through 12, when said computerprogram product is run on a digital computer.
 28. Apparatus configuredfor use as said testing apparatus (A) in a system as claimed in any ofthe claims 13 through
 23. 29. Apparatus configured for use as saidmonitoring apparatus (S₁, . . . , S_(k), . . . , S_(n)) in a system asclaimed in any of the claims 13 through
 23. 30. Apparatus configured foruse as said collecting apparatus (H), within a system as claimed in anyof the claims 13 through
 23. 31. Apparatus configured for use as saidapparatus for the centralised management (M) of the quality of serviceof the network within a system as claimed in claim 17.